Mastering Linux Security and Hardening - Second Edition

Detecting and deleting default user accounts

One challenge of dealing with Internet of Things (IoT) devices is that you don't do a normal operating system installation on them as you would when setting up a normal server. Instead, you download an image that has the operating system pre-installed, and burn that image to a microSD card. The installed operating system is set up with a default user account, and many times that user is set up with full sudo privileges and isn't required to enter a sudo password. Let's take, for example, the Raspex Linux distribution for the Raspberry Pi. (Raspex is built from Ubuntu source code.) On the documentation page of the Raspex download site, we see that the default user is raspex, and the default password ...